Skip to content
Fencer Vulns
medium 5.5

CVE-2023-5752 json

Mercurial configuration injectable in repo revision when installing via pip

published 2023-10-24 3 y ago modified 2026-09-10 1 mo ago also GHSA-mq26-g339-26xf , PYSEC-2023-228 , EUVD-2023-0200

cvss
5.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits
0
none known

Summary

When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

Patch / fix

  • pypi pip 23.3
  • Pip maintainers pip 23.3
  • python-pip Debian 14, Debian 13 23.3+dfsg-1

debian advisories DEBIAN-CVE-2023-5752

  • receptor ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.8-1.el8ap
  • receptor ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.8-1.el9ap
  • python-idna ansible automation platform developer 2.4, ansible automation platform 2.4 3.7-1.el9ap
  • receptorctl ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.8-1.el8ap
  • receptorctl ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.8-1.el9ap
  • python-black ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 22.8.0-2.el9ap
  • python3-idna ansible automation platform developer 2.4, ansible automation platform 2.4 3.7-1.el9ap
  • python-jinja2 ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 3.1.4-1.el9ap

red hat advisories RHSA-2024:3781

  • python312-pip SLE Module for Python 3 15 SP6, openSUSE Leap 15.6 23.2.1-150600.3.3.1
  • python36-pip SLES for SAP 12 SP5, SLES 12 SP5 20.2.4-8.15.1
  • python-pip SLE Module for Python 3 15 SP5, SLE Module for Python 3 15 SP4, openSUSE Leap 15.5 +1 more 22.3.1-150400.17.12.1
  • python-pip SLES for SAP 12 SP5, SLES 12 SP5 10.0.1-13.14.1

suse advisories SUSE-SU-2024:3156-1SUSE-SU-2024:0892-1SUSE-SU-2023:4988-1SUSE-SU-2023:4987-1

  • python3 Azure Linux 3.0 3.12.3-1
  • python3 CBL-Mariner 2.0 3.9.19-14

azure linux advisories AZL-39958AZL-60006

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-5752 updated cvss 3.3

pip: Mercurial configuration injectable in repo revision when installing via pip

  • Red Hat Enterprise Linux 7 python-pip, python3-pip
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 9 python3-pyrsistent Red Hat OpenShift Dev Spaces devspaces/udi-rhel8 Red Hat Quay 3 quay/quay-rhel8
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower 4.5.7-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower 4.5.7-1.el9ap
    fixed: vendor fix RHSA-2024:3781
  • Red Hat Ansible Automation Platform 1.2 ansible-tower Red Hat Ansible Automation Platform 2 python3x-pyrsistent Red Hat Ansible Automation Platform 2.4 for RHEL 8 receptor 1.4.8-1.el8ap, python39-idna 3.7-1.el8ap, python3x-idna 3.7-1.el8ap, receptorctl 1.4.8-1.el8ap, ansible-core 2.15.11-1.el8ap, ansible-test 2.15.11-1.el8ap, +38 more Red Hat Ansible Automation Platform 2.4 for RHEL 9 receptor 1.4.8-1.el9ap, python-idna 3.7-1.el9ap, python3-idna 3.7-1.el9ap, receptorctl 1.4.8-1.el9ap, python-black 22.8.0-2.el9ap, python-jinja2 3.1.4-1.el9ap, +38 more Red Hat Enterprise Linux 8 python-pip, python3-pip, python3.12-pip, python3-pip-wheel, platform-python-pip, python3.12-pip-wheel Red Hat Enterprise Linux 9 python-pip, python3-pip, python3.12-pip, python3.14-pip, python3-pip-wheel, python3.12-pip-wheel, +1 more
    +2 more products
    Red Hat Enterprise Linux 10 python3.14-pip Red Hat Service Telemetry Framework 1.5 stf/prometheus-webhook-snmp
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.50% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD 3.1 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
GitHub 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
OSV 3.1 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
pypi pip
<23.3
23.3

Affected products

  • Pip maintainers pip

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.